Tag: threat
-
Agentic AI memory attacks spread across sessions and users, and most organizations aren’t ready
In this Help Net Security interview, Idan Habler, AI Security Researcher at Cisco, breaks down a threat most security teams haven’t named yet: agentic memory as an … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/14/idan-habler-cisco-agentic-ai-memory-attacks/
-
APT41 Targets Linux Cloud Servers With New Winnti Backdoor
A previously undocumented Linux backdoor attributed to China-linked threat group APT41 (Winnti) has been uncovered, targeting cloud workloads across AWS, GCP, Azure, and Alibaba Cloud. The ELF-based implant, currently showing zero detections on VirusTotal, transforms Linux servers into stealthy credential theft nodes using a novel SMTP-based command-and-control (C2) mechanism. The discovery indicates a new phase in APT41’s Linux and cloud-targeted…
-
CISA Warns Fortinet SQL Injection Flaw Is Being Actively Exploited
Tags: cisa, cve, cyber, cybersecurity, exploit, flaw, fortinet, infrastructure, injection, kev, sql, threat, vulnerabilityThe Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding a critical security flaw in Fortinet software. On April 13, 2026, CISA added CVE-2026-21643 to its Known Exploited Vulnerabilities (KEV) catalog. This action confirms that threat actors are actively exploiting this weakness in real-world cyberattacks. CISA maintains this authoritative database to help…
-
Rockstar’s GTA Game Hacked, 78.6 Million Records Published Online
Rockstar Games has suffered a significant data breach after the infamous threat group ShinyHunters leaked over 78.6 million internal records on April 14, 2026. The incident did not involve a direct attack on Rockstar’s primary network infrastructure. Instead, the hackers executed a supply-chain attack through a third-party analytics platform, highlighting the escalating risk of integrated…
-
NSFOCUS Threat Intelligence Interviewed in The Top Trends Shaping Threat Intelligence in Asia Pacific Report by International Authority
Forrester, an international authoritative consulting firm, released “The Top Trends Shaping Threat Intelligence in Asia Pacific”. With its deep technical accumulation, product system and mature solutions in the field of threat intelligence, NSFOCUS was interviewed for the report. As enterprises cope with the rapidly changing cybersecurity and regulatory environment in the Asia-Pacific region, threat intelligence…The…
-
Best of the Worst: Five Attacks That Already Knew Your Name
<div cla TL;DR This week’s Attack of the Day posts revealed a clear shift from volume to precision. A phishing PDF auto-launched a credential harvest page the instant it opened, no click required. A QR code inside another PDF had the target’s email address pre-encoded in base64, so the landing page pre-filled the victim’s username…
-
How is Agentic AI driving innovation in cybersecurity?
What Role Do Non-Human Identities Play in Cybersecurity? Securing digital environments often brings to mind defending against human threats, but what about machine identities? Known as Non-Human Identities (NHIs), these are crucial elements that are becoming increasingly relevant in cybersecurity frameworks. With the rapid evolution of Agentic AI innovation and other advanced technologies, the management……
-
When AI Finds a Way Out: The Alibaba Incident and Why Zero Trust Matters More Than Ever
Tags: access, ai, control, cybersecurity, data-breach, detection, firewall, flaw, identity, malware, network, software, threat, training, zero-trustThe incidentIn cybersecurity, the most important lessons rarely come from theory, but reality.A recent incident involving an experimental AI agent in the Alibaba ecosystem is one of those moments that forces us to pause and rethink some of our core assumptions. During what should have been just model training, the Alibaba AI agent began behaving…
-
APT41 Delivers ‘Zero-Detection’ Backdoor to Harvest Cloud Credentials
The prolific China-backed threat group is targeting AWS, Google, Azure, and Alibaba cloud environments and using typosquatting to obscure C2 communication. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/apt41-zero-detection-backdoor-harvest-cloud-credentials
-
APT41 Delivers ‘Zero-Detection’ Backdoor to Harvest Cloud Credentials
The prolific China-backed threat group is targeting AWS, Google, Azure, and Alibaba cloud environments and using typosquatting to obscure C2 communication. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/apt41-zero-detection-backdoor-harvest-cloud-credentials
-
Mailbox Rule Abuse Emerges as Stealthy Post-Compromise Threat
Attackers are abusing Microsoft 365 mailbox rules to hide activity, exfiltrate data and retain access after account compromise, researchers warn First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/mailbox-rule-abuse-stealthy-post/
-
13th April Threat Intelligence Report
The Los Angeles Police Department has reported a data breach involving a digital storage system used by the L.A. City Attorney’s Office. The exposure included 7.7 terabytes and more than 337,000 files, […] First seen on research.checkpoint.com Jump to article: research.checkpoint.com/2026/13th-april-threat-intelligence-report/
-
Your MTTD Looks Great. Your Post-Alert Gap Doesn’t
Anthropic restricted its Mythos Preview model last week after it autonomously found and exploited zero-day vulnerabilities in every major operating system and browser. Palo Alto Networks’ Wendi Whitmorewarned that similar capabilities are weeks or months from proliferation. CrowdStrike’s 2026 Global Threat Report puts average eCrime breakout time at 29 minutes. Mandiant’s M-Trends 2026 First seen…
-
Rockstar Games gets a taste of grand theft data amid ShinyHunters threat of ‘Pay or leak’
Gang claims it accessed Snowflake metrics via third-party tool First seen on theregister.com Jump to article: www.theregister.com/2026/04/13/shinyhunters_rockstar_breach/
-
Iran-Linked CyberAv3ngers Target Water Utilities, Industrial Controllers
Iran-linked threat group CyberAv3ngers is intensifying attacks on U.S. water utilities and industrial control systems, shifting from noisy hacktivism to sustained disruption of operational technology (OT) environments. CyberAv3ngers operates as a state-directed persona for Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC), not as an independent hacktivist crew. U.S. Treasury sanctions in February 2024 named six IRGC-CEC…
-
Basic-Fit Suffers Data Breach Affecting Millions Across Multiple Nations
European fitness operator Basic-Fit has confirmed a significant data breach affecting approximately one million members across its network. The incident heavily impacted users in the Netherlands, which accounted for 200,000 of the compromised accounts. This breach underscores the persistent targeting of consumer lifestyle platforms by threat actors seeking massive datasets. The cyber incident targeted the…
-
CPUID watering hole attack spreads STX RAT malware
Threat actors compromised the CPUID website and spread STX RAT through fake CPU-Z and HWMonitor downloads. Attackers breached the website CPUID and replaced download links for CPU-Z and HWMonitor with malicious files for several hours. Users who downloaded them got infected with the STX RAT, giving attackers remote access to their systems. The short attack…
-
Granular Cryptographic Compartmentalization of Contextual Metadata
Learn how granular cryptographic compartmentalization secures contextual metadata in MCP deployments against quantum threats and AI-specific attacks. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/granular-cryptographic-compartmentalization-of-contextual-metadata/
-
How does Agentic AI ensure compliance in healthcare?
What Role Does Non-Human Identities (NHI) Play in Securing Cloud Environments? Cybersecurity domain is continually evolving, and threats increasingly target gaps left by human oversight. Have you considered how Non-Human Identities (NHI) are becoming pivotal in mitigating these threats, especially within cloud environments? With machine identities become more prominent, their management proves crucial in strengthening……
-
CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads
Unknown threat actors compromised CPUID (“cpuid[.]com”), a website that hosts popular hardware monitoring tools like CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor, for less than 24 hours to serve malicious executables for the software and deploy a remote access trojan called STX RAT.The incident lasted from approximately April 9, 15:00 UTC, to about April 10, 10:00…
-
Censys finds 5,219 devices exposed to attacks by Iranian APTs, majority in U.S.
Tags: apt, attack, automation, cisa, cyberattack, data-breach, exploit, infrastructure, Internet, iran, technology, threatCensys researchers found 5,219 exposed Rockwell PLCs online, mostly in the U.S., urging defenders to secure or disconnect them. On April 7, 2026, U.S. agencies, including FBI, CISA, and NSA, warned of Iran-linked APTs exploiting internet-exposed Rockwell Automation PLCs. Threat actors are carrying out cyberattacks targeting internet-connected operational technology (OT) across multiple critical infrastructure sectors.…
-
GlassWorm evolves with Zig dropper to infect multiple developer tools
The GlassWorm campaign uses a Zig-based dropper hidden in a fake IDE extension to infect developer tools and compromise systems. The GlassWorm campaign, active since 2025, has evolved from malicious npm packages to large-scale supply chain attacks across GitHub, npm, and VS Code, even deploying RATs via fake browser extensions. In its latest iteration, threat…
-
GlassWorm evolves with Zig dropper to infect multiple developer tools
The GlassWorm campaign uses a Zig-based dropper hidden in a fake IDE extension to infect developer tools and compromise systems. The GlassWorm campaign, active since 2025, has evolved from malicious npm packages to large-scale supply chain attacks across GitHub, npm, and VS Code, even deploying RATs via fake browser extensions. In its latest iteration, threat…
-
CVE-2026-39987: Marimo RCE exploited in hours after disclosure
A critical flaw, tracked as CVE-2026-39987, in the open-source Python notebook tool Marimo was exploited within 10 hours of disclosure. A critical flaw in Marimo, tracked as CVE-2026-39987 (CVSS score of 9.3) was exploited just 10 hours after disclosure (On April 8, 2026). Sysdig Threat Research Team observed exploitation of the Marimo flaw within 9…
-
Claude and ChatGPT Exploited in Sweeping Cyber Campaign Against Government Agencies
In a groundbreaking technical report released by Gambit Security researcher Eyal Sela, new details have emerged about a massive cyberattack targeting government infrastructure. A single threat actor successfully leveraged artificial intelligence platforms to breach nine Mexican government agencies. The campaign, which operated from late December 2025 through mid-February 2026, resulted in the exfiltration of hundreds…
-
The AI Arms Race Just Went Public: What Anthropic’s Project Glasswing Means for Every Security Team Blog – Menlo Security
Anthropic’s Project Glasswing found decades-old bugs in minutes. Discover why traditional patching is no longer enough and how to contain threats at the browser First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/04/the-ai-arms-race-just-went-public-what-anthropics-project-glasswing-means-for-every-security-team-blog-menlo-security/